In Focus: RSA Security Taps the 'Other BPM'In Focus: RSA Security Taps the 'Other BPM'

Three-letter acronyms are rife in the technology industry, much to the confusion and dismay of the user community. Just last week I received a letter from a reader who asked "why wasn't Hyperion mentioned" in Bruce Silver's column "Sizing Up the BPM 'Leaders.'"

What the reader failed to notice was that Silver makes it clear in the first sentence that he's writing about business process management (BPM), not business performance management. It's easy to understand the confusion, so at Intelligent Enterprise we've tried to avoid this problem by calling it just plain performance management. Others call it corporate performance management (CPM), but the confusion between the two BPMs persists.

It doesn't help, either, that performance management is all about processes: namely, strategy formulation, planning, budgeting, forecasting, financial consolidation and reporting. Business process management has helped some companies manage financial consolidation (particularly since the Sarbanes-Oxley Act required controls in this area), but performance management takes aim at these processes head on. It has been the specialty of business intelligence vendors such as Hyperion, Business Objects, Cognos and SAS as well as enterprise resource planning (ERP) vendors such as SAP, Lawson, Oracle and Oracle/PeopleSoft.

Just what can performance management do for you? Security technology supplier RSA Security has been practicing and perfecting performance management for more than six years, and it has realized benefits including faster and more accurate budgeting and financial reporting as well as better, more profit-driven strategic and product planning.

RSA's goal when it adopted performance management in 2000 was to improve the accuracy of its budgeting. It chose GEAC's MPC (Management Performance Controls) software to tame a highly distributed process involving operations in more than 30 countries. The budget and accompanying forecasts spell out spending plans and revenue expectations by function, geographic region and legal entity, and when they prove inaccurate, the results are quickly and sometimes painfully felt on Wall Street.

"Every quarter when we do analyst calls, everyone wants to know about revenue and earnings for the next quarter," said RSA executive Dave Stack at a recent GEAC user group meeting in New York. "As director of financial planning and analysis, my responsibility is to make sure that if we deliver X in revenue, we'll deliver Y per share as promised--it's right because the forecasts are on target."

Of course, one of the biggest and oldest complaints about the budgeting process is that it's so labor-intensive, but performance management software has helped RSA cut down full-time-equivalent weeks spent on the annual budgeting process from 150 in 2000 to 60 today. "That has made the difference between getting the budget done in November instead of February," said Stack, adding that the efficiencies also helped the company move from quarterly to more responsive and accurate monthly forecasts in 2002. It now takes four days to update companywide forecasts rather than the 13 days required in 2000.

RSA's performance management investments proved prescient, as they anticipated many of the financial reporting controls later mandated by the Sarbanes-Oxley Act. The monthly forecast is now used as a control process, and the company has used its own security software in combination with log files to capture approval "signatures" by the CFO and auditors.

Once budgeting and forecasting initiatives were underway, RSA took a step to improve product performance, using MPC to look at profits and losses and compare R&D, marketing and sales expenditures against competitors by product. The modeling approach lets the company analyze the impact on profit and growth of, say, adding engineers and more sales channels to one product line while shifting resources from underperforming products.

"We may think that the authentication market is going to grow by 15 percent, but we may have new products or new programs that could accelerate that, and we can build that into the forecast and budget," Stack said. "It has been a really nice add-on to the system."

Stack said one of MPC's key advantages is that it's tightly integrated with Microsoft Excel, so business users can work in their preferred tool with few additional training demands for the product's "Excel Services." MPC 7, released in November 2005, added reporting to the Excel-based functionality. "That alone is worth the upgrade," Stack said. "We've always been asking GEAC, 'When can we have everything in Excel.'"